Moole Vulnerability Database

Find real vulnerabilities before they ship

Critical

CVE-2026-29063

Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.

VectorNETWORK

PublishedMar 06, 2026, 19:16

Published Bysecurity-advisories@github.com

Base Score

Score9.8

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

immutable(npm)4.0.0-rc.14.3.8N/A

immutable(npm)5.0.05.1.5N/A

immutable(npm)03.8.3N/A

References

https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3
https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8
https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5
https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw

Weakness Type

CWE-1321

CVSS Metrics

Base Score

8.7

Vector String

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Base SeverityHigh

Version

4.0

Attack Vector (AV)

NETWORK